Should you be assessing risk like NASA?